Regulation and data
DPA (data processing agreement)
A DPA (data processing agreement) is the contract that art. 28.3 of the GDPR requires between the controller and each processor: it sets out the subject matter, duration, nature and purpose of the processing, the type of data and of data subjects, and each party's obligations and rights.
Also known asdata processing agreement · processor agreement · contrato de encargo del tratamiento
What it has to say
Art. 28.3 leaves nothing to the imagination. Besides describing the processing, the contract has to stipulate that the processor:
- processes the data only on the controller's documented instructions, including as regards sending them to a third country;
- ensures that those who process them are bound by confidentiality;
- applies the security measures of art. 32;
- engages no other processor —a sub-processor— without the controller's prior written authorisation;
- helps the controller respond to data subjects' rights and comply with arts. 32 to 36;
- when the service ends, deletes or returns the data, at the controller's choice;
- makes available the information needed to show that it complies, and allows audits.
Worth knowing
It has to be in writing, electronic form included (art. 28.9). An email saying "we accept your terms" is not enough if it does not contain that content. If the processor handles the data outside the EU, the transfer also needs a safeguard, such as the standard contractual clauses, and what it processes on behalf of each client goes into its own ROPA. Who each party is is explained under controller and processor; a published example is Bedel's processing agreement.
Sources
Related terms
- Controller and processorThe controller is whoever decides what personal data are processed for and how; the processor is whoever processes them on the controller's behalf. In a residence, the centre is the controller of its residents' data, and the software supplier or the caterer that handles them for it is a processor.
- ROPA (record of processing activities)The ROPA, or record of processing activities, is the document art. 30 of the GDPR requires of controller and processor: what data are processed, what for, whose, who receives them, whether they leave the EU, when they are deleted and under what security measures. It goes to the supervisory authority on request.
- Standard contractual clausesStandard contractual clauses are model contracts approved by the Commission that provide appropriate safeguards for sending personal data outside the EU when the destination country has no adequacy decision. The ones in force are those of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.